# /webhook

Updates the webhook configuration for the authenticated partner.
## Purpose
Allows a partner to partially update their webhook configuration including the URL, subscribed events, and active status.
## When to use
Use this endpoint to:
- Change the webhook endpoint URL (triggers secret regeneration)
- Update the list of subscribed event types
- Activate or deactivate the webhook without deleting it

## What happens next
1. The request is validated (webhook_id is required, at least one updatable field must be provided)
2. If a new URL is provided, it is validated (HTTPS, max 2048 chars) and a new secret is generated
3. Only the specified fields are updated; unspecified fields remain unchanged
4. The full updated configuration is returned in the response

## Authentication
Requires `x-client-id` and `x-secret-key` headers.
## Notes
- PUT requires webhook_id in the request body to identify which webhook to update
- GET /webhook?webhook_id=xxx and DELETE /webhook?webhook_id=xxx use query parameters
- This is a partial update — only provided fields are modified
- Changing the URL triggers webhook_secret regeneration (new secret returned in response)
- If events are provided, the array must not be empty
- If no webhook registration exists for the given webhook_id, returns 404

## Common errors
- `400` Invalid URL format, unsupported event types, empty events list, or missing webhook_id
- `401` Invalid credentials
- `404` No webhook configuration exists for this webhook_id
- `500` Internal error during update

Endpoint: PUT /webhook
Version: 1.0.0

## Header parameters:

  - `x-client-id` (string, required)
    Unique identifier assigned to the integrating client.

Error codes: required=400001, type=400002, minLength=400003, maxLength=400004

  - `x-secret-key` (string, required)
    Secret authentication key associated with the client.

Error codes: required=400001, type=400002, minLength=400003, maxLength=400004

## Request fields (application/json):

  - `webhook_id` (string, required)
    UUID v4 identifier of the webhook to update. Required for PUT operations.
Error codes: required=400001, type=400002

  - `url` (string)
    New HTTPS endpoint URL for webhook notifications. If provided, triggers regeneration of the webhook_secret. Must use HTTPS scheme and not exceed 2048 characters.
Error codes: type=400002, minLength=400003, maxLength=400004, pattern=400009

  - `events` (array)
    Updated list of transaction status event types to subscribe to. If provided, must contain at least one valid event type.
Error codes: type=400002

  - `active` (boolean)
    Whether the webhook should be active. Set to false to temporarily disable notifications without removing the configuration.
Error codes: type=400002

  - `branches` (array)
    List of branch IDs to receive notifications for. Use ["all"] to receive notifications for all branches. If not provided, the current value is preserved.
Error codes: type=400002

## Response 200 fields (application/json):

  - `status` (string)
    Response status (success)

  - `data` (object)
    Updated webhook configuration

  - `data.webhook_url` (string)
    The current webhook URL

  - `data.events` (array)
    List of subscribed event types

  - `data.active` (boolean)
    Whether the webhook is currently active

  - `data.webhook_secret` (string)
    New signing secret (only present if URL was changed). Store securely.

  - `data.created_at` (string)
    ISO 8601 UTC timestamp of original registration

  - `data.updated_at` (string)
    ISO 8601 UTC timestamp of this update

## Response 400 fields (application/json):

  - `errors` (array)
    List of validation errorsError catalog for 400 (click to expand)CodeDescription400001Invalid event type provided or empty events list (at least one event type is required)400009URL does not match required HTTPS pattern400004URL exceeds maximum length of 2048 characters400010Event type is not in the list of supported event types

  - `errors.status` (string)

  - `errors.code` (number)

  - `errors.message` (string)

  - `errors.details` (string)

## Response 401 fields (application/json):

  - `errors` (array)
    List of authentication errorsError catalog for 401 (click to expand)CodeDescription401000Invalid credentials

  - `errors.status` (string)

  - `errors.code` (number)

  - `errors.message` (string)

  - `errors.details` (string)

## Response 404 fields (application/json):

  - `errors` (array)
    List of not found errorsError catalog for 404 (click to expand)CodeDescription404000No webhook configuration exists for this webhook_id

  - `errors.status` (string)

  - `errors.code` (number)

  - `errors.message` (string)

  - `errors.details` (string)

## Response 500 fields (application/json):

  - `errors` (array)
    List of server errorsError catalog for 500 (click to expand)CodeDescription500000Internal server error during update

  - `errors.status` (string)

  - `errors.code` (number)

  - `errors.message` (string)

  - `errors.details` (string)